The situation
The European Commission published practical, non-binding guidance on 27 July for companies implementing the Cyber Resilience Act (CRA). The guidance covers product scope, substantial modifications, support periods, risk assessments and reporting duties, with 67 examples and particular attention to smaller businesses.
Mandatory reporting begins on 11 September 2026 for manufacturers of hardware and software products with digital elements placed on the EU market. A reportable event requires an early warning within 24 hours of awareness and a notification within 72 hours; submissions will go through the CRA Single Reporting Platform to the CSIRT in the manufacturer’s main establishment and, except in exceptional circumstances, to ENISA. As of 1 August, the Commission said the platform was still undergoing functional and security testing and was due to be operational by the reporting start date.
Why it matters
The guidance narrows practical uncertainty before the first operational CRA deadline, but does not change the Act’s statutory timetable or create binding new rules. It gives EU and non-EU suppliers selling digital products into the EU a clearer basis for preparing internal incident detection, escalation and reporting processes.
The September reporting regime will connect manufacturers more directly with national incident-response authorities and ENISA, improving the EU’s visibility of actively exploited product vulnerabilities and severe security incidents. The main product-security obligations remain scheduled to apply on 11 December 2027, leaving companies time to adjust product development, documentation and conformity-assessment processes.
What changed
The Commission issued non-binding implementation guidance on 27 July; the reporting platform remains in testing rather than live operation.
Impacts
Political Stability
The guidance prepares a common EU reporting workflow for actively exploited vulnerabilities and severe product-security incidents, strengthening coordination between manufacturers, national CSIRTs and ENISA ahead of the September deadline.
Trade & Supply Chains
Manufacturers selling connected hardware or software into the EU must prepare reporting and compliance processes for the September start, while broader product-security obligations remain due in December 2027.
Economic Pressure
The non-binding guidance reduces interpretive uncertainty for suppliers, but firms still face implementation costs for incident handling, documentation and, for specified product categories, conformity assessment.
What to watch
- Does the Commission confirm that the CRA Single Reporting Platform is operational by 11 September 2026?
- Do manufacturers and national CSIRTs publish or identify material implementation obstacles before mandatory reporting begins?
Evidence and uncertainty
Low confidence. Low confidence. 3 retained references from 1 reporting origins (European Commission). Claim-level independent corroboration has not been established. Confidence concerns the evidence for the reported development, not the probability of an outlook.
Useful context
Cyber Resilience Act (CRA)
Regulation (EU) 2024/2847, which establishes lifecycle cybersecurity requirements for hardware and software products with digital elements placed on the EU market.
It sets the reporting and product-security obligations addressed by the Commission guidance.
CSIRT
Computer Security Incident Response Team, a national body that receives and coordinates cyber-incident information.
Manufacturers will submit CRA reports to the CSIRT of their main establishment.
ENISA
The European Union Agency for Cybersecurity.
CRA reports are generally made available to ENISA through the reporting process.
Geographic context
- 01Brussels, Belgium (city)